Essential Eight AC-ML2.6 Event logs are protected from unauthorised modification and deletion
What it says
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that event logs are secure from being changed or deleted by unauthorised users.
Event logs are like security cameras for your computer systems. They record what's happening in the background, which can help investigate suspicious activity. If someone unauthorised could change or delete these logs, you might miss signs of a cyber attack or data breach.
Free. Save your status, tasks and notes.
Why it matters
If unauthorised changes or deletions occur, critical security events can be concealed, making it challenging to detect breaches or understand attack paths.
How to implement
The IT team should restrict access to event logs to authorised personnel only by setting strict user permissions.
The system administrator should use security software to monitor event logs and alert the team if any unauthorised changes are detected.
The security officer should ensure logs are backed up regularly, so if they are tampered with, there is always a copy to review.
The IT team should implement logging systems that can separate and protect the event logs from regular system access, ensuring they cannot be easily modified.
The system administrator should regularly review user permissions and modify them if necessary to ensure only trusted personnel have access to the logs.
Keep it running
Restrict log access, use append-only or immutable storage, and monitor for deletions/changes to preserve integrity for investigations and audit.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Who has access to modify or delete event logs on your systems?
Look at
Check the system's access control settings and list of authorised users for event log access.
Good evidence
Only specific IT personnel have access, and access control settings are regularly reviewed and updated.
- Check 2 of 2What an auditor asks for
Ask for
How are event logs monitored for unauthorised changes?
Look at
Review the monitoring system setup and logs of alerts generated on unauthorised access attempts.
Good evidence
The logs are consistently monitored, and any unauthorised access attempts are logged and investigated immediately.
Mappings
Closest match in ASD Information Security Manual: ISM-1815, Protect event logs from unauthorised access, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity and availability for investigation. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes (but is not limited to) protecting logs against tampering and loss. Annex A 8.15 is broader because it also covers log generation and ongoing analysis, whereas E8-AC-ML2.6 focuses specifically on preventing unauthorised change or deletion.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.8.
Annex A 6.2.8 requires the organisation to enable event logging for AI systems during defined life cycle phases, at minimum when the AI system is in use. E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, which is a key integrity control for any AI system logs once collected. Annex A 6.2.8 is about enabling/recording logs, while E8-AC-ML2.6 is about safeguarding those logs against tampering.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1815.
ISM-1815 requires event logs to be protected from unauthorised modification and deletion. E8-AC-ML2.6 states the same requirement with the same intent and outcome for log integrity. Both focus on preventing unauthorised tampering or removal of logs rather than broader log collection or analysis activities.
This control is broader than ISM-1624.
ISM-1624 requires PowerShell script block logs to be protected using Protected Event Logging functionality. E8-AC-ML2.6 requires event logs generally to be protected from unauthorised modification and deletion, which includes PowerShell-related event logs in scope. ISM-1624 is a specific technical instantiation for one high-value log source (PowerShell script blocks), whereas E8-AC-ML2.6 applies broadly to event logs across systems.
This control partially overlaps ISM-0582.
ISM-0582 requires security-relevant Windows events to be centrally logged. E8-AC-ML2.6 overlaps by requiring logs be protected from unauthorised change, a key integrity measure for centralised logging. ISM-0582 covers central collection, while E8-AC-ML2.6 covers log safeguarding, addressing different aspects of logging controls.
This control partially overlaps ISM-1976.
ISM-1976 requires central logging of macOS security events. E8-AC-ML2.6 relates by requiring event logs to be protected from unauthorised modification and deletion, which is an integrity safeguard commonly applied to centrally collected logs. ISM-1976 focuses on ensuring central collection on macOS, while E8-AC-ML2.6 focuses on tamper protection and integrity controls regardless of OS.
This control partially overlaps ISM-1985.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, focusing on preventing tampering and removal. ISM-1985 requires event logs to be protected from unauthorised access, which overlaps through access controls that also help prevent unauthorised changes. However, ISM-1985 is primarily confidentiality-focused (read/access), while E8-AC-ML2.6 explicitly targets integrity/availability impacts (modify/delete).
This control partially overlaps ISM-2052.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ASD Essential Eight E8-AC-ML2.6 focuses on protecting event logs from unauthorised modification and deletion, which helps preserve the confidentiality and integrity of any sensitive data that appears in logs. ISM-2052 also covers protecting sensitive log content even when logs are not being altered (e.g., access controls, redaction, secure handling), which E8-AC-ML2.6 does not explicitly address.
This control supports ISM-0580.
E8-AC-ML2.6 requires organisations to ensure event logs cannot be modified or deleted by unauthorised users. ISM-0580 requires an event logging policy to be developed and maintained, which supports E8-AC-ML2.6 by formalising requirements for log access controls, retention, protection mechanisms and responsibilities. ISM-0580 is governance-focused and does not itself implement technical protections, so it complements rather than matches the Essential Eight requirement.
This control supports ISM-1405.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion. ISM-1405 implements a centralised event logging facility, which supports E8-AC-ML2.6 by reducing the ability of attackers or local administrators to tamper with logs on individual endpoints and by enabling stronger access control and retention controls on the logging platform. Centralisation helps but does not, by itself, guarantee immutability or prevent authorised-but-inappropriate deletion without additional access and retention safeguards.
This control depends on ISM-1660.
ISM-1660 requires central logging of allowed and blocked application control events so they are available for monitoring and investigation. E8-AC-ML2.6 strengthens this by requiring event logs be protected from unauthorised modification and deletion, helping preserve the integrity of the centrally collected application control events. ISM-1660 focuses on central collection, while E8-AC-ML2.6 focuses on tamper protection of the logs once generated/collected.
This control depends on ISM-1989.
ISM-1989 requires event logs to be retained in accordance with AFDA Express minimum retention requirements. E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, which helps ensure logs can actually be retained for the required duration. ISM-1989 is about how long to keep logs, while E8-AC-ML2.6 is about protecting their integrity and availability to enable that retention.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including by encryption; E8-AC-ML2.6 (application control) requires event logs to be protected from unauthorised modification and deletion, a subset of that.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log store that protects logs from unauthorised access or modification; E8-AC-ML2.6 (application control) requires event logs to be protected from unauthorised modification and deletion, overlapping on modification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.